Facebook Pressed to Tackle Lingering Privacy Concerns

This afternoon, CDT joined nine other public interest organizations in an open letter to Facebook president Mark Zuckerberg asking Facebook to keep working to address the outstanding privacy issues on its site.

Certainly, the furor has died down a bit after Zuckerberg announced a big round of privacy improvements in response to intense user criticism over some of the company’s new policies. And Facebook deserves credit for tackling one of its biggest problems: simplifying its panoply of dozens of confusing sharing controls into a simpler and more intuitive interface. Facebook also announced for the first time that things you "like" — such as movies, celebrities, hobbies, or news stories — could be shared with just friends, or friends of friends. This control is still somewhat hidden (for some reason it’s under "Basic Directory Information") but it represents a huge step forward, offering users granular controls for sharing where none previously existed ("fan pages," the previous iteration of "likes," had no option at all to limit sharing).

That said, today's letter says Facebook still needs to work on several lingering problems.
Most notably, the much-criticized "Instant Personalization" feature is still turned on by default for all users. Under "Instant Personaliaztion," when you visit certain other sites while logged onto Facebook, the site shows you what your Facebook friends are doing on those sites. For instance, if you visit the internet radio station Pandora while logged onto Facebook, you can see what music all your Facebook friends have been listening, whether they ever agreed to share their listening habits with you or not. Facebook had previously allowed users to link external sites to Facebook through its "Facebook Connect" program; the key difference, of course, is that using Facebook Connect is the affirmative choice of the consumer — not Facebook or its partners. Facebook needs to make "Personalization" active only if users choose it. So far, Facebook has only signed up three companies for "Instant Personalization." As more sites sign up as Instant Personalization partners, it becomes more important that Facebook to allow users to choose whether or not they want to participate in the program.

Another major issue that Facebook needs to address stems from its deployment of "social plugins" all around the web. Since rolling out just a couple of months ago, over 200,000 sites have installed these plugins — such as a "Like" button — to allow Facebook users to more quickly publish "likes" and "recommendations" to their Facebook newsfeeds, and to show users what other content on that site friends or others have liked or recommended. However, if you visit a plugin-enabled site while logged onto Facebook, Facebook knows that you’ve visited that page whether you click "Like" or not. Through these plugins, Facebook has the ability to track users across these 200,000 sites and assemble detailed profiles about its members (Facebook has stated in its FAQ that it’s not sharing this data with third parties or using it to deliver ads). Facebook has also said that it’s anonymizing all data collected from social plugins within 90 days, but it really shouldn’t be using it on an individualized basis at all — Facebook doesn’t need to know everything I’ve read on Washington Post or TechCrunch, or what movies I’ve looked at on the Internet Movie Database. The issue is exacerbated by Facebook’s change to make its logout button only accessible through a pull-down menu under "Account," meaning more and more users will stay logged in when they visit plugin-enabled sites around the web.

Our letter also calls for Facebook to adopt granular controls for all information sharing — including letting consumers decide what applications to share data with, and with whom to share core information such as name, gender, profile picture, and networks. Facebook should also allow users to encrypt communications with Facebook using the HTTPS protocol to ensure that private and semi-private communications through the site stay that way.

Our last request is that Facebook make its data fully portable, so that users who decide they no longer want to use the site can easily download their profiles to their own computers, or transfer them to another site. So far, it appears that relatively few users have actually quit the site due to privacy issues, but if some do decide they want to leave, they should be able to take their information them. This principle applies to any company that allows users to store data remotely, and many other cloud computing services are building in tools to allow users to export their data whenever they choose.

CDT is committed to working with Facebook to solve its remaining privacy challenges. The revamped privacy controls released last month were an excellent step forward. We just need to make sure the remaining important issues don’t fall by the wayside.